{"record":{"id":"e0f61dfb36cf2e04","repo":"dotnet/runtime","slug":"openssl-is-not-available-but-required-for-build-d","errorCode":null,"errorMessage":"OpenSSL is not available, but required for build determinism\n","messagePattern":"OpenSSL is not available, but required for build determinism\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/coreclr/ilasm/assem.cpp","lineNumber":255,"sourceCode":"    if (m_pCeeFileGen != NULL) {\n        if (m_pCeeFile)\n            m_pCeeFileGen->DestroyCeeFile(&m_pCeeFile);\n\n        DestroyICeeFileGen(&m_pCeeFileGen);\n\n        m_pCeeFileGen = NULL;\n    }\n\n    if (FAILED(CreateICeeFileGen(&m_pCeeFileGen))) return FALSE;\n    if (FAILED(m_pCeeFileGen->CreateCeeFileEx(&m_pCeeFile,(ULONG)m_dwCeeFileFlags))) return FALSE;\n    if (FAILED(m_pCeeFileGen->GetSectionCreate(m_pCeeFile, \".il\", sdReadOnly, &m_pILSection))) return FALSE;\n    if (FAILED(m_pCeeFileGen->GetSectionCreate (m_pCeeFile, \".sdata\", sdReadWrite, &m_pGlobalDataSection))) return FALSE;\n    if (FAILED(m_pCeeFileGen->GetSectionCreate (m_pCeeFile, \".tls\", sdReadWrite, &m_pTLSSection))) return FALSE;\n\n#if !defined(_WIN32) && !defined(__APPLE__)\n    if (m_fDeterministic && !IsOpenSslAvailable())\n    {\n        fprintf(stderr, \"OpenSSL is not available, but required for build determinism\\n\");\n        return FALSE;\n    }\n#endif\n\n    m_fGeneratePDB = generatePdb;\n\n    return TRUE;\n}\n\nvoid Assembler::SetDLL(BOOL IsDll)\n{\n    HRESULT OK;\n    OK = m_pCeeFileGen->SetDllSwitch(m_pCeeFile, IsDll);\n    _ASSERTE(SUCCEEDED(OK));\n\n    m_fDLL = IsDll;\n}\n","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/dotnet/runtime/blob/290d5ab72cc1102813fbc0406fb186ceadabc340/src/coreclr/ilasm/assem.cpp#L237-L273","documentation":"On non-Windows, non-Apple platforms, ilasm's deterministic-build mode (`/DETERMINISTIC` or `m_fDeterministic`) requires a stable hash for metadata; the implementation delegates to OpenSSL via IsOpenSslAvailable() (sha256.h). If the runtime cannot load the OpenSSL crypto library at startup, Assembler::Init (assem.cpp:253) refuses to proceed and returns FALSE, because deterministic output cannot be guaranteed without it.","triggerScenarios":"Running ilasm with deterministic mode enabled on Linux where libssl/libcrypto is missing, is the wrong version, or is not on the loader search path.","commonSituations":"Minimal container images (e.g. alpine) without the openssl package; a distro upgrade that removed or relocated libssl; running a bundled ilasm that was built expecting a specific OpenSSL soname.","solutions":["Install the OpenSSL runtime libraries for your distro (e.g. `apt-get install libssl1.1` or `apk add openssl`).","Ensure libssl/libcrypto are on LD_LIBRARY_PATH or in the default loader path.","Drop the `/DETERMINISTIC` flag if deterministic builds are not required.","Rebuild ilasm against the OpenSSL version present on the host."],"exampleFix":"// before\nilasm /DETERMINISTIC /out:foo.dll foo.il   # fails, no libssl\n// after\napt-get install -y libssl1.1 && ilasm /DETERMINISTIC /out:foo.dll foo.il","handlingStrategy":"validation","validationCode":"# Before running deterministic ilasm on Linux, confirm OpenSSL loads.\nldconfig -p | grep -q libcrypto.so && ldconfig -p | grep -q libssl.so \\\n  || { echo 'OpenSSL missing; install or drop /DETERMINISTIC'; exit 1; }\n# Or test-load: ldd $(command -v ilasm) | grep -E 'libssl|libcrypto'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Base CI images on a distro that ships the expected OpenSSL (e.g. debian-slim, not alpine without openssl).","Pin ilasm and the OpenSSL soname together in Dockerfiles.","Document the OpenSSL requirement wherever /DETERMINISTIC is used."],"tags":["ilasm","openssl","deterministic","linux","native-dependency"],"analyzedSha":"290d5ab72cc1102813fbc0406fb186ceadabc340","analyzedAt":"2026-08-06T19:57:01.276Z","schemaVersion":2},"datasetVersion":"2026-08-06T23:17:07.152Z"}